Privacy Policy

Last updated 1 September 2026.

This Privacy Policy explains how we process data relating to visitors, buyers and people who contact us through qo-sport.com.

1. Data controller

The controller is MB Qosport, legal entity code 306716721, registered address Vilkaviškio g. 18, LT-68174 Marijampolė, Lithuania. For privacy and personal-data enquiries, contact info@qo-sport.com.

2. Data we process

  • Order and contact data: name, email, telephone number, delivery address or selected parcel locker, products, sizes, quantities, prices and order status.

  • Payment data: payment method, amount, currency, payment status and transaction identifiers provided by Paysera. We do not receive full card details or online-banking credentials.

  • Delivery and return data: carrier, shipment and tracking identifiers, delivery events, returned items, comments, return status and correspondence. If a refund cannot be made to the original payment method, we may request the recipient name and IBAN; these are encrypted and erased when the refund is completed.

  • Gift coupon data: a secure lookup value for the coupon number, an encrypted copy for documents, the PIN verification value, balance, redemption and expiry information.

  • Communications: emails, requests, complaints and other information you choose to supply.

  • Technical data: IP address, request time, browser or device information, security and system logs, and essential-cookie identifiers. If you consent to analytics, we also process usage data collected through Google Analytics.

3. Purposes and legal bases

  • Entering into and performing a contract: cart, order, payment, delivery, tracking, returns, refunds, gift-coupon issue and customer service.

  • Legal obligation: financial accounting, invoices, tax records, handling consumer requests and mandatory disclosures to public authorities.

  • Legitimate interests: store and payment security, prevention of fraud and abuse, diagnosis of technical faults, establishment or defence of legal claims, and service quality. Before relying on this basis, we assess that our interests are not overridden by your rights.

  • Consent: non-essential website analytics. Consent may be withdrawn at any time; withdrawal does not affect processing carried out before it.

Accepting the Terms and acknowledging this Policy at checkout is not consent to advertising; marketing and promotional emails require a separate optional checkbox. Transactional order and delivery messages are sent to perform the contract.

4. Sources of data

Most data is supplied directly by you during checkout, order tracking, a return request or correspondence. We receive payment status and transaction identifiers from Paysera and shipment status and tracking information from delivery providers.

5. Recipients

We share only the data necessary for the relevant service with:

  • Paysera for payments, refunds and the ordering of delivery services;

  • the selected carrier, including Omniva, LP Express, Venipak or SmartPosti, for delivery, tracking and, where applicable, a return label;

  • website hosting, email, IT maintenance and security providers acting under data-processing terms and our instructions;

  • Google Analytics, only after you consent;

  • accounting, legal or audit providers and public authorities where needed for a service, to defend our rights or to meet a legal requirement.

We do not sell personal data. Where a provider processes data outside the European Economic Area, we use a valid transfer safeguard such as an adequacy decision or the European Commission's standard contractual clauses.

6. Cookies and analytics

Essential cookies support the session, cart, security and core store functions and do not require separate consent. Google Analytics code loads only after explicit consent. You can decline analytics or change your selection here.

7. Retention

  • Order, invoice, payment and related accounting data is retained for the period required by law; issued invoices and related data are generally retained for 10 years.

  • Delivery, return, complaint and correspondence data is retained for as long as needed to perform the contract, address warranty or consumer claims, and establish or defend legal claims.

  • Incomplete-order and security-log data is retained for as long as reasonably necessary to verify payment status, manage reservations, investigate fraud and protect systems.

  • An IBAN and recipient name supplied for a refund are erased once that refund is completed.

  • Analytics retention is determined by our Google Analytics configuration and your consent status.

Data may be retained longer where required by law, while a dispute is pending, or where necessary to defend a lawful claim. When the applicable period ends, data is deleted or irreversibly anonymised.

8. Your rights

Depending on the circumstances, the GDPR gives you the right to:

  • receive information and access your personal data;

  • correct inaccurate or complete incomplete data;

  • request erasure or restriction of processing;

  • object to processing based on legitimate interests;

  • receive data you supplied in a structured, commonly used and machine-readable format where data portability applies;

  • withdraw consent at any time;

  • complain to a supervisory authority.

Send a request to info@qo-sport.com. We may reasonably verify identity to avoid disclosing data to somebody else and will respond within the GDPR deadline. Erasure may not apply where we must retain data by law or need it for a legal claim.

9. Security and automated decisions

We use access controls, encryption, backups, security logs and other risk-appropriate technical and organisational measures. QO does not make decisions based solely on automated processing that produce legal or similarly significant effects for you. Payment providers may apply their own fraud-prevention and payment-authorisation processes under their privacy information.

10. Complaints and changes

If you believe data has been handled improperly, please contact us first. You may also complain to the Lithuanian State Data Protection Inspectorate, L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania, vdai.lrv.lt.

We may update this Policy when services or laws change. The current version and its date are always published on this page.